The objective of the attacker performing a backdoor attack is to corrupt the Byzantine-robust FedGAN  [1]}, leading to model divergence or converging to sub-optimal. In FL settings, adversarial clients attack the server generator using poisoned images as the input of discriminator so that the generator can be fooled, no longer generating fake medical-valued images \(\tilde{x}\)  with high fidelity. That is, \(p_{(\tilde{x}|y)} \ne p_{(x|y)}\) , for \(x\)  as real image and \(y\)  as the corresponding real label.
